Work with a Seriously Better Team

Australian Privacy Principle (APP) entities include the following:

• Federal government agencies
• Individual, corporate, partnership, unincorporated or trust organisations
• Small business operators who turnover $3 million or more

APP entities must notify the Australian Information Commissioner of any known or suspected data breaches that are likely to cause individuals serious harm, so they may take steps to protect themselves.

The Australian Privacy Principles govern how personal information is collected, used, stored, and disclosed. They can be summarized as follows:

• Anonymity and pseudonymity
• Dealing with unsolicited personal information
• Notification of the collection of personal information
• Use or disclosure of personal information
• Direct marketing
• Quality of personal information
• Security and access of personal information
• Correction of personal information

Privacy laws place a higher value on protecting “sensitive information” such as:

• Racial or ethnic origin
• Political opinions
• Religious affiliations
• Sexual orientation
• Criminal record
• Health, genetics, and biometrics data
• Professional or trade union memberships

This type of “sensitive information” is more strictly controlled than “personal information.” While consent is not required to collect personal information, sensitive information may only be collected with consent. It may not be used for a secondary purpose, direct marketing, or sharing with related corporate bodies.

The privacy laws Australia has put in place not only extend to citizens in the country but also to travellers, foreign expatriates, and “any entity with an Australian link.”

For APP entities, these laws also apply to any enterprise “with an Australian link”—any entities formed in Australia, with central management or control in Australia, or which otherwise carry out business in Australia.